Implemented on claude/chrome-extension-ui-requirements-h6a0vo
The executable-requirements UI suite is in under client/dev/requirements/, and the portable guideline is at docs/ui-testing-guideline.md. client CI is green on both commits.
What landed
- 27 leaf requirements ⇄ 27 cases, segmented by verification kind: 9
dom (serialized-DOM goldens), 8 behavior (coded gestures), 10 logic (coded rules), + 1 tbd tracking the real-browser e2e gap honestly.
- One jsdom + fake-
chrome.* harness drives the real sidepanel.mjs / options.mjs, so goldens/behaviors track shipped code (faking only inputs). Clock, locale, and timezone are pinned; expecteds are owner-owned.
- Coverage: panel states, optimistic post (success/failure/empty), XSS-safe rendering, author/time formatting, the accessibility contract, the options editor, and manifest UI surfaces.
- Rendering is one lightweight kind (reviewable text goldens, not pixels), per the steer to focus on the practice over HTML rendering. The guideline has a dedicated, proportionate HTML-rendering section.
- Wiring:
client.yml + release.yml now npm ci before the client tests (the lane needs jsdom); test:ui / refresh:ui scripts; dev/ never ships.
Hardening (from an adversarial self-review)
The gate now fails on a kind with no runner, on a tbd downgrade of a wired leaf (committed allowlist), and on a snapshot kind with no producer; the harness no longer swallows app-async failures; the options golden now proves "one host per line". Each guard was verified red on its exploit and green otherwise.
Branch is pushed and ready to review/merge (no PR opened — say the word if you'd like one).
Implemented on
claude/chrome-extension-ui-requirements-h6a0voThe executable-requirements UI suite is in under
client/dev/requirements/, and the portable guideline is atdocs/ui-testing-guideline.md.clientCI is green on both commits.What landed
dom(serialized-DOM goldens), 8behavior(coded gestures), 10logic(coded rules), + 1tbdtracking the real-browser e2e gap honestly.chrome.*harness drives the realsidepanel.mjs/options.mjs, so goldens/behaviors track shipped code (faking only inputs). Clock, locale, and timezone are pinned; expecteds are owner-owned.client.yml+release.ymlnownpm cibefore the client tests (the lane needsjsdom);test:ui/refresh:uiscripts;dev/never ships.Hardening (from an adversarial self-review)
The gate now fails on a kind with no runner, on a
tbddowngrade of a wired leaf (committed allowlist), and on a snapshot kind with no producer; the harness no longer swallows app-async failures; the options golden now proves "one host per line". Each guard was verified red on its exploit and green otherwise.Branch is pushed and ready to review/merge (no PR opened — say the word if you'd like one).